c0510e527a29327b8750b20e20a2a484e1c22110d3f63e033648f6a5c549b9cd

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7ee40f90ff2858e24450ca308ab0389_JaffaCakes118.pdf
Size 183KB
Sample240614-ehwkpsthqa
SHA256 c0510e527a29327b8750b20e20a2a484e1c22110d3f63e033648f6a5c549b9cd
MD5 a7ee40f90ff2858e24450ca308ab0389
SHA1 8a28f29b84b1235e4402c0caaf284f807e074b47
SHA512 69b86e6055b62f56cfe3f2196432ac1ff296798af03ad6cc7f276dedc8f277cc819678384471f198ddaeaa7e3cd5d4baaec3c868987a2119c31a437183b33825
SSDEEP 3072:E2irbxzGAFYDMxud7fKg3dXVmbOn5uC6KjnHE46oZ/cY5ycpxfP+Sr:E2MKlWQ7Sg3d4bOXx1cYEcvZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3616	AcroRd32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3616	AcroRd32.exe
3616	AcroRd32.exe
3616	AcroRd32.exe
3616	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 1680	3616	AcroRd32.exe	85
PID 3616 wrote to memory of 1680	3616	AcroRd32.exe	85
PID 3616 wrote to memory of 1680	3616	AcroRd32.exe	85
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 2064	1680	RdrCEF.exe	86
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87
PID 1680 wrote to memory of 3028	1680	RdrCEF.exe	87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a7ee40f90ff2858e24450ca308ab0389_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D9CF1EA4C1D2075048415B4634F999D1 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2064
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F96AF9EF62654F5E96F923CC237D6DAB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F96AF9EF62654F5E96F923CC237D6DAB --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3789FF83372EE7197A123EE91A0A98AA --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3184
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D1EB695BED67BB90F33072540C9AA2CA --mojo-platform-channel-handle=1912 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1336
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A7D4FB4DE7533EA012B62F9E52778B89 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A7D4FB4DE7533EA012B62F9E52778B89 --renderer-client-id=6 --mojo-platform-channel-handle=1828 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A8BF076F72D362F4D08EF8729F8D4272 --mojo-platform-channel-handle=2380 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 38b2b7398593857b10d589b66bde1c0f4a00defba98fcaebbe52b490cd0598ab
MD5 021db7d1e351c55d878084db02165be8
SHA1 ea95ac27ec90aabc6efb52fba6f720264369d531
SHA512 9661e5966b9c48ebecef3b8613158c79aec970790a15286afd7eec5e10515f5092be7058a11f17b2745626a3659b9f495e06e9b1b36e689c08ee489e0f18d7ca
SSDEEP 384:yeLdThPstELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:js+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download